cs.AISep 30, 2026

Sapien: A Stateful Policy Engine for Autonomous AI Agents

Authors: Corinn Tiffany, Wen Zhang, Eugene Bagdasarian, Lillian Tsai

Organizations: Google · University of Massachusetts Amherst

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Contextual security defenses prevent AI agents from taking rogue actions by synthesizing a task-specific policy and enforcing it on the agent's tool calls. In multi-step tasks, however, which actions are valid often depends on what the agent has already done and learned. We present Sapien, a policy engine for enforcing stateful contextual policies. A Sapien policy specifies permitted tool-call sequences using a regular expression extended with stateful predicates, deferred policy generation, and scoped semantic checks. We show that Sapien stays within a few percent of an unconstrained agent's utility. Even if the agent is fully hijacked, Sapien's policies rule out 93-95% of attacks on AgentDojo and 62-85% on Toolathlon (twice as many as tool allowlists on long-horizon tasks).

Figures & tables

Figure 1 . Policy tightness depends on language expressiveness. If a policy admits trajectories beyond the task’s appropriate trajectories , it also permits rogue actions. A stateless policy (e.g., an allowlist) over-approximates because it cannot reference changing runtime context. A stateful policy more tightly encloses appropriate behavior. Policy tightness depends on language expressiveness.
Figure 2 . Sapien architecture. Before execution begins, the policy generator translates the task prompt into a task-specific policy, reading no external content. During execution, the enforcer checks every proposed tool call against the policy, returning feedback on denials and recording tool results for use in later checks. \sysarchitecture.
Figure 4. Enforcement of a policy with two shuffled subtasks.
Figure 5 . AgentDojo utility results across models. Sapien achieves comparable task completion to NoPolicy and AllowList across all 97 tasks. Bar chart showing task pass rates on the 97-task AgentDojo suite across four models for NoPolicy, AllowList, and \sys.
Figure 6 . Toolathlon utility across models. Sapien roughly matches NoPolicy and improves over generated AllowList policies. Bar chart showing task pass rates on the 20-task multi-model suite and full 108-task suite of Toolathlon for NoPolicy, AllowList, and \sys.
 Analytical Defense Rate
ModelNoPolicyAllowListSapien
Gemini 3.8 Flash0%86.4%93.4%
Claude Opus 50%85.8%94.8%
Claude Sonnet 50%86.8%95.2%
Gemini 3.1 Pro0%82.7%93.2%
Figure 7. AgentDojo analytical security evaluation. Table showing the fraction of the 949 AgentDojo attack instances blocked by NoPolicy, AllowList, and \sysacross four models.
 Analytical Defense Rate
BenchmarkNoPolicyAllowListSapien
20-Task Suite (40 Attack Instances / Model)
Gemini 3.8 Flash0%30.0%67.5%
Claude Opus 50%22.5%85.0%
Claude Sonnet 50%30.0%62.5%
Gemini 3.1 Pro0%35.0%77.5%
Figure 8. Toolathlon analytical security evaluation. Table showing the analytical defense rate of NoPolicy, AllowList, and \syson the Toolathlon 20-task suite across four models and on the full 212-instance suite with Gemini 3.8 Flash.
Figure 8

Explore similar work

CardsList

  1. ToolGuardian: Declarative Security for AI Agent-Tool Interactions

    Jul 23, 2026Arun Ravindran, Saurabh DeochakeAuthorizationAgentic Deployments

    Department of Electrical and Computer Engineering University of North Carolina at Charlotte Charlotte, NC · SentinelOne Mountain View, CA

  2. AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use

    May 6, 2026Chenglin YangRuntime Safety FilteringUntrusted Content

    Independent Researcher

  3. Agent Security Needs Redefinition through a Holistic Framework

    Jul 24, 2026Vincent Siu, Jingxuan He, Kyle Montgomery +3SecurityAuthorization

    1UC Santa Cruz · 2UC Berkeley